Carbide Mantle: Endpoint Visibility Tool

Your compliance platform already pulls most of your evidence without you. Cloud configuration, access reviews, policy sign-off, vendor records, all collected and mapped while you work on something else. Then the auditor asks you to show that the laptops your team works on are secure, and the automation stops.

At that point you are usually doing one of two things. You are starting a thread asking people to send screenshots of their device settings, or you are exporting something out of a Mobile Device Management (MDM) tool that was never built to answer that question and reconciling it against a spreadsheet of who has which machine. Both take days, both go stale the moment someone buys a new laptop, and neither produces something you would want to hand an auditor.

Carbide Mantle closes that gap. Your staff install an agent, each device is benchmarked against the compliance obligations your program covers, and the results land in the asset module you are already using.

The bottom two rows are the line between Carbide Mantle and an MDM, and they are deliberate. More on that below.

What Carbide Mantle is

Mantle is an endpoint visibility platform. Your staff install an open source agent on their devices, and from that point Mantle benchmarks each endpoint against the compliance obligations in scope for your program. Every check returns a pass or a fail.

One check might confirm that Bluetooth is disabled on a laptop. The benchmarks are preconfigured, so nothing needs building on your side before the first results arrive.

Mantle catalogs the software on each endpoint alongside those checks. That inventory reaches past conventionally installed applications into development packages, and Mantle compares what it finds against known vulnerabilities, contextualized to how that specific endpoint is used. A vulnerable package on a developer’s workstation is a different problem from the same package sitting on a machine that never touches production.

One agent, every obligation in your program

Benchmarks ship out of the box for SOC 2, ISO 27001, HIPAA, GDPR and CMMC, and Carbide is actively adding more. Nothing is selected or built on your side.

This matters because endpoint evidence is the part of a program that gets rebuilt most often. The device posture a SOC 2 reviewer wants is close to what an ISO 27001 auditor wants for the same control objective, and close again to what a CMMC assessor will ask for. Collecting it once per certification is how teams lose weeks. Mantle collects it once and benchmarks it against each obligation you are working toward, which is the same pattern as the rest of your Carbide program: start with one framework, add the next without starting over.

Query your endpoint data, and report on it

Your endpoint data is queryable through Carbide Analyst, the same as the rest of your program data. Ask which devices are failing a given check, or what a particular package’s exposure looks like across your fleet, and turn the answer into a report without assembling it by hand.

How the data reaches your compliance program

Carbide’s customer success team sets up the API key that connects Mantle to your account. Once that is in place, the setup instructions appear in your Carbide settings for your staff to follow. There is no separate product for anyone to sign in to.

As devices come online they appear in the sync hosts list in Asset Manager. You select the ones you want to sync, and from then on they report in hourly alongside the assets you already track.

Open any device and you get its online status, when it was last seen, hardware detail such as memory and available disk space, its full software inventory, its pass or fail status against each check, and its status logs. Everything your asset records could already do applies to these devices without change.

Where Carbide Mantle stops, and why

Mantle reports on endpoints. It does not manage them. It will not push an update or change a device’s configuration remotely. That boundary is a product decision and Carbide has no current plans to move into endpoint control.

This is also why Mantle is worth running where an MDM is already in place. MDM tools were designed for IT teams managing enterprise assets, and audit readiness was never the problem they were built to solve. The two products answer different questions, so running both is a reasonable position.

Where Mantle sits in the Carbide model

Mantle is platform automation. It gathers endpoint data and benchmarks it with no one in the loop, and your Carbide advisory team does not run it for you.

What changes for your advisors is the ground truth they work from. When endpoint evidence is live and benchmarked continuously, the credentialed advisors guiding your certification spend their time on your compliance program instead of reconciling a device list before they can start. That is the shape of Carbide overall: software that automates the collection, and a credentialed advisory team that carries the work through to a finished audit.

How to get started

1. Ask your advisor or email support@carbidesecure.com to set up your Mantle API key.
2. Your staff follow the installer instructions in your Carbide settings.
3. Select the devices you want in scope from the sync hosts list in Asset Manager.
4. Review the first pass or fail results as those devices report in hourly.

Start with the devices that will be in scope

You do not need a rollout plan to find out whether this works for you. Install the agent on a handful of devices, select them in Asset Manager, and the first benchmark results land within the hour, against the frameworks your program is already working toward.

Talk to your advisor or support@carbidesecure.com about turning Mantle on before your next evidence request.